Incident Response & Digital Investigation
IR
Incident response and digital forensics: correlating access logs, packet captures and file artifacts to reconstruct an intruder's kill-chain and recover split, multiply-encoded evidence.
- Six Ways Out The title gives it away: six files leave the box over six different channels, each with its own encoding. The endpoint logs say what was taken and how it was encoded; the pcap holds the actual bytes.
- Dead Drop An internet-facing server, web01.northstar.local (192.168.56.20), was compromised. We have three artifacts: incident.pcap, access.log and server_image.png. The attacker took data out of the network and tried to cover their tracks. The flag…
No write-ups match your filter.